What happened
AWS disclosed (security bulletin 2026-070-AWS, published 08/03/2026) an improper endpoint restriction in the Amazon MQ MCP Server's RabbitMQ broker connection tools, allowing a remote unauthenticated actor via prompt injection to exfiltrate broker credentials or OAuth tokens to an attacker-controlled endpoint.
Why it matters
This is another instance of the emerging MCP credential-exfiltration-via-prompt-injection pattern: an AI assistant with MCP tool access to enterprise message brokers can be tricked into leaking live credentials to an attacker, enabling lateral movement into production messaging infrastructure.
Attack vector
The RabbitMQ broker connection tools (rabbitmq_broker_initialize_connection / _with_oauth) accept a broker_hostname argument that is LLM-controllable via the MCP client context. A prompt-injected hostname pointing to an attacker-controlled endpoint causes the server to send Amazon MQ RabbitMQ broker credentials or OAuth access tokens to that endpoint instead of the legitimate broker.
Affected systems
awslabs.amazon-mq-mcp-server (Amazon MQ MCP Server) <= 2.0.23
Mitigation
Upgrade to awslabs.amazon-mq-mcp-server 2.0.24+. Until patched, disable auto-approve on the affected tools so a user must visually inspect broker_hostname before execution.